Circuit board to hold connector pieces for tamper detection circuit

ABSTRACT

A circuit board is protected by being enclosed in a security housing that includes conductive tamper traces running along its interior surface, the conductive tamper traces being a housing portion of a tamper detection circuit. The tamper detection circuit also includes a board portion that detect tampering with the tamper detection circuit by monitoring voltages at monitor nodes along the board portion. The board portion of the tamper detection circuit is connected to the tamper traces via multiple connector pieces. The connector pieces can be held in place by board connector piece holders affixed to the board or housing connector piece holders of the housing. When tampering is detected, it can be localized based on voltages measured at multiple recesses along the housing. The tamper detection circuit can be arranged in a wheatstone bridge layout for environmental tolerance. The circuit board&#39;s functions/components can be disabled if tampering is detected.

BACKGROUND

Certain devices, such as credit card or debit card reading devices,include circuitry that reads, stores, or transmits sensitiveinformation. Sensitive information can include credit card numbers,debit card numbers, personal identification number (“PIN”) codes, orpersonal identification information, for example. If unprotected, amalicious party can sometimes retrieve such sensitive information fromthe devices by accessing the circuitry that stores or transmits thesensitive information.

Some devices that read, store, or transmit sensitive information includea tamper circuit that passes current through a tamper trace. Such atamper circuit can detect tampering by detecting when current stopsflowing along the conductive tamper trace. Such a tamper circuit cansometimes be bypassed if a malicious party short-circuits the tampercircuit, breaks or reroutes a tamper trace by drilling into the device,or floods a portion of the tamper circuit with conductive ink, amongother attacks.

Thus, there is a need in the art for improved tamper circuitry.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A is an exploded perspective view of a circuit board enclosedwithin a top housing and a bottom housing and connected to the tophousing via connector pieces.

FIG. 1B is an exploded perspective view of a circuit board enclosedwithin a side housing and connected to the side housing via connectorpieces.

FIG. 2A illustrates a top-down view of a circuit board with four boardconductive node sets, with a close-up view of one board conductive nodeset.

FIG. 2B illustrates a top-down view of a circuit board with four boardconductive node sets, each attached to a board connector holder forholding a connector piece, with a close-up view of one board conductivenode set and its attached board connector holder.

FIG. 3A illustrates a perspective view of a “wire” style connectorpiece.

FIG. 3B illustrates a perspective view of an uncovered “zebra” styleconnector piece.

FIG. 3C illustrates a perspective view of a covered “zebra” styleconnector piece.

FIG. 4A illustrates an exterior surface of a top housing.

FIG. 4B illustrates an interior surface of the top housing with noconductive portions shown.

FIG. 4C illustrates the interior surface of the top housing with anexemplary arrangement of tamper traces of varying voltages.

FIG. 4D illustrates the interior surface of the top housing with aschematic diagram of tamper traces of varying voltages the arrangementof FIG. 4C.

FIG. 4E illustrates the interior surface of the top housing with noconductive portions shown and with housing connector holders.

FIG. 5A is a circuit diagram illustrating a discrete comparison tampercircuit.

FIG. 5B is a circuit diagram illustrating a wheatstone bridge tampercircuit.

FIG. 6 is a flow diagram illustrating additional components of a tampercircuit.

FIG. 7A is an exploded side view of a circuit board with board connectorholders connecting to a top housing via connector pieces.

FIG. 7B is an exploded side view of a circuit board connecting to a tophousing with housing connector holders via connector pieces.

FIG. 8 is an exploded side view of an exemplary tamper zone recess.

FIG. 9 is a block diagram of exemplary components that may be present onthe circuit board.

DETAILED DESCRIPTION

A circuit board that reads, stores, or transmits sensitive informationcan be protected from tampering by enclosing at least a portion of thecircuit board within a security housing.

A circuit board is protected by being enclosed in a security housingthat includes conductive tamper traces running along its interiorsurface, the conductive tamper traces being a housing portion of atamper detection circuit. The tamper detection circuit also includes aboard portion that detect tampering with the tamper detection circuit bymonitoring voltages at monitor nodes along the board portion. The boardportion of the tamper detection circuit is connected to the tampertraces via multiple connector pieces. The connector pieces can be heldin place by board connector piece holders affixed to the board orhousing connector piece holders of the housing. When tampering isdetected, it can be localized based on voltages measured at multiplerecesses along the housing. The tamper detection circuit can be arrangedin a wheatstone bridge layout for environmental tolerance.

The tamper detection circuit, or other circuitry connected to the tamperdetection circuit, can be configured to take various tamper protectionactions upon detection of tampering. These tamper protection actions caninclude temporarily or permanently disable at least a portion of thecircuit board's functionality, deleting sensitive information stored bythe circuit board, encrypting sensitive information stored by thecircuit board, deleting all information stored by the circuit board,encrypting all information stored by the circuit board, transmitting analert to another system, transmitting sensitive information to anothersystem after encryption, displaying an indicator (e.g. a light emittingdiode) indicating tampering, damaging the circuit board by overheatingthe circuit board, damaging the circuit board by flooding it with wateror conductive ink, or some combination thereof. Such tamper protectionactions minimize damage caused by device tampering by preventingsensitive data from being accessed by a malicious party and by ensuringthat a tampered-with device is not able to be used again in its tamperedstate, protecting individuals who might otherwise trust such potentiallydangerous devices with sensitive information such as paymentinformation.

FIG. 1A is an exploded perspective view of a circuit board enclosedwithin a top housing and a bottom housing and connected to the tophousing via connector pieces.

The exploded view of FIG. 1A illustrates a circuit board 100 protectedby a security housing made up of a top housing 105 and a bottom housing110. The circuit board 100 can read, store, and/or transmit sensitiveinformation. For example, the circuit board 100 can store symmetric orasymmetric encryption keys for encrypting information transmitted toother circuitry not protected by the security housing, and can performencryption and/or decryption operations using the encryption keys. Thecircuit board 100 can also include, or can be electrically connected to,one or more card reader components (not pictured) for readingtransaction information stored by a transaction card such as a creditcard, a debit card, an Automated Teller Machine (ATM) card, a store giftcard, a public transit card, a driver's license, a personalidentification card, a door entry card, a security badge, or somecombination thereof. The circuit board 100 can also include, or can beelectrically connected to, one or more computing interface components(not pictured) to receive transaction information from a portablecomputing device, such as a cellular phone or a portable media playerwith a wireless transaction capability through Near-Field-Communication(NFC) signals, radio-frequency identification (RFID) signals, BLUETOOTH™wireless signals, or some combination thereof. The circuit board 100 caninclude non-transitory data storage media for temporarily or permanentlystoring such transaction information, as well as wired or wireless datatransfer means, such as cables, plugs, ports, or antennae, fortransferring such data. The circuit board 100 can be single-sided ordouble-sided, and can be a printed circuit board (PCB), a printed wiringboard (PWB) with non-printed components, a perfboard, a stripboard, abreadboard, or some combination thereof.

The circuit board 100 of FIG. 1A includes board portion 155 of a tamperdetection circuit 150. The board portion 155 of a tamper detectioncircuit 150, which on its own, is an incomplete circuit. When completed,the tamper detection circuit 150 conducts electricity across conductivetamper traces 420 (not shown in FIG. 1A) that snake around an interiorsurface of the security housing. One exemplary layout of the tampertraces 420 is illustrated in FIG. 4C. The tamper traces 420 can beconnected to the board portion 155 of the tamper detection circuit 150in such a way that some of the tamper traces 420 conduct differentvoltages than other tamper traces 420. The board portion 155 of thetamper detection circuit 150 includes monitor nodes 530 (not shown inFIG. 1A) that monitor voltages at different points and can thus detectif current stops flowing across one or more tamper traces 420, or ashort circuit is experienced among the tamper traces 420, issues thatcan occur if a malicious party tampers with the security housing bydrilling into the security housing, by attempting to reroute currentwithin the tamper detection circuit 150, or by flooding a portion of thetamper detection circuit 150 with conductive ink. The tamper detectioncircuit 150, when completed, can be arranged in a discrete comparisoncircuit layout as illustrated in FIG. 5A or can be arranged in awheatstone bridge layout as illustrated in FIG. 5B. The discretecomparison circuit layout can, in certain environmental conditions suchas high heat or high humidity, suffer from “false positive” reports oftampering when no actual tampering has occurred due to development aparasitic resistance 590 between points of the tamper detection circuit150 that are not directly connected. The wheatstone bridge layout solvesthis issue as further explained in the descriptions of FIGS. 5A and 5B.

The board portion 155 of the tamper detection circuit 150 is connectedto the conductive tamper traces 420 of the security housing viaconnector pieces 160. Each connector piece can be at least partiallyelastic to ensure that the connection between the board portion 155 ofthe tamper detection circuit 150 and the conductive tamper traces 420 ofthe security housing do not disconnect during ordinary operations. Eachconnector piece 160 can be held in place by a board connector pieceholder 255 as illustrated in FIG. 2B, a housing connector piece holder430 as illustrated in FIG. 4E, or some combination thereof. The boardportion 155 of the tamper detection circuit 150 can further beconfigured to detect tampering with the connector pieces 160 bydetecting voltage changes caused by connections between the connectorpieces 160 and various conductive elements placed around or near theconnector pieces 160 that conduct different voltages than are flowingthrough the connector pieces themselves, such as the conductive guardrings 220 illustrated in FIG. 2A or the conductive board connector pieceholders 255 illustrated in FIG. 2B, respectively.

While the exploded view of FIG. 1A illustrates both a top housing 105and a bottom housing 110, some security housings can include only a tophousing 105 or only a bottom housing 110. In embodiment with both a tophousing 105 and a bottom housing 110, tamper traces 420 can run alongthe interior surfaces of both the top housing 105 and the bottom housing110, or they can run along only one of the top housing 105 or the bottomhousing 110. Tamper traces 420 of the top housing 105 can connect totamper traces 420 of the bottom housing 110 or can remain separate.

Furthermore, while the top housing 105 and bottom housing 110 appearsimilarly shaped in FIG. 1A, this need not be the case; for example, thebottom housing 110 can be substantially flat while the top housing 105can leave more room for components of the circuit board 100. Such anasymmetric layout can be used, for example, if the circuit board 100 isone-sided.

While the exploded view of FIG. 1A illustrates four connector pieces160, it should be understood that in different embodiments, a differentnumber of connector pieces 160 can be used to connect the circuit board100 to the tamper traces 420. Likewise, while the exploded view of FIG.1A only illustrates connector pieces 160 between the circuit board 100and the top housing 105, in other embodiments, connector pieces 160 canbe used to between the circuit board 100 and the bottom housing 110 aswell.

The top housing 105 of FIG. 1A includes an antenna 140 on the exteriorsurface 145 of the top housing 105. The antenna 140 can be a wirelessreceiver antenna, a wireless transmitter antenna, or a wirelesstransceiver antenna. The antenna 140 can be, for example, a cellularnetwork antenna, a Bluetooth™ local wireless connection antenna, aBluetooth™ Low Energy (BLE) local wireless connection antenna, aradio-frequency antenna, a microwave-frequency antenna, atelevision-frequency antenna, a near-field-communication (NFC) antenna,an IEEE 802.11 Wi-Fi wireless antenna, or some combination thereof.While the antenna 140 of FIG. 1A is positioned along an exterior surface145 of the top housing 105, it can alternately be included into thenon-conductive interior of top housing, or can alternately be positionedalong an interior surface of the top housing 105. The antenna 140 canalternately be placed along or inside the bottom housing 105.

The non-conductive portions of the top housing 105 and bottom housing110, which may also be referred to as the non-conductive “cage” or“shell,” can be made from plastic, such as thermoplastics manufacturedusing Laser Direct Structuring (LDS), or from other non-conductivematerials. The non-conductive portions of the top housing 105 and bottomhousing 110 can be fused to each other and/or to the non-conductiveboard of the circuit board 100 to prevent opening the security housing,or can alternately be affixed with glue, cement, or other adhesives. Thenon-conductive portions of the top housing 105 and bottom housing 110are typically hard but can in some cases have a degree of flexibility.The tamper traces 420 can be laid out over the inside surface of thesecurity housing during an LDS manufacturing process, if LDS is used.

The top housing 105 and bottom housing 110 of FIG. 1A also illustratesseveral pockets 130 to receive compression clips 135. The compressionclips 135 function not only to keep the security housing fastened to thecircuit board 100, but also to prevent bowing in the non-conductiveboard 200 portion of the circuit board 100 itself, a common issue thatcan affect circuit boards 100 over time and eventually cause damagecircuitry. The compression clips 135 themselves are not pictured in FIG.1A, but can be any type of clips that provide pressure, such as clipsbased on elastomers, clips based on springs, clips based on metals withelastic properties, magnetic clips, or some combination thereof. Thecompression clips 135 can alternately be clamps, such as manually closedscrew-based clamps.

The one or more reader components of the circuit board 100 can include amagnetic read head or other type of magnetic stripe reader that iscapable of reading information from a magnetic stripe of a transactioncard. The one or more reader components can also include an integratedcircuit (IC) chip reader for reading an IC chip embedded in atransaction card. Such an IC chip can follow the Europay-Mastercard-Visa(EMV) payment IC chip standard. The IC chip reader can be contact-based,in that it can include one or more conductive prongs that contact aconductive metal contact pad of the IC chip. The IC chip can instead becontactless and use a contactless antenna. The contactless antenna canalso double as a receiver for near-field-communication (NFC) signals,radio-frequency identification (RFID) signals, BLUETOOTH™ wirelesssignals, or some combination thereof, which can be sent from atransaction card or from a portable computing device.

FIG. 1B is an exploded perspective view of a circuit board enclosedwithin a side housing and connected to the side housing via connectorpieces.

The side housing 115 can receive the circuit board 100 and connectorpieces 160 through a side opening, after which a cap 170 can be fused oradhered to the side housing. The side housing 115 can include tampertraces 420 all along its interior. The cap 170 can likewise includetamper traces 420 along its interior surface. Any tamper traces 420 ofthe cap 170 can connect to tamper traces 420 of the side housing 115.

Another alternate embodiment of the security housing (not pictured) caninclude two smaller side housings 115 fused together, each enclosing aportion of the circuit board, including a “left-side” side housing and a“right-side” side housing, each with conductive tamper traces 420running along its interior. Tamper traces 420 of the “left-side” sidehousing can connect to tamper traces 420 of the “right-side” sidehousing or can remain separate.

FIG. 2A illustrates a top-down view of a circuit board with four boardconductive node sets, with a close-up view of one board conductive nodeset.

The circuit board 100 of FIG. 2A includes a non-conductive board 200with four board conductive node sets 205, identified by identifiers205A, 205B, 205C, and 205D, respectively. While the four boardconductive node sets 205 are spaced roughly evenly along thenon-conductive board 200, they can alternately be place asymmetricallyor clustered in a different layout.

The close-up view of FIG. 2A illustrates a close-up of board conductivenode set 205A. The conductive node set 205A of FIG. 2A includes a firstconnection node 210A configured to conduct a first voltage A and asecond connection node 210B configured to conduct a second voltage B.The first connection node 210A and the second connection node 210B areconfigured to be connected to the tamper traces 420 via a connectorpiece 160, and form part of the board portion 155 of the tamperdetection circuit 150.

The conductive node set 205A of FIG. 2A also includes two holder nodes215 configured to conduct a third voltage C. The holder nodes 215 can beconnected to part of the board portion 155 of the tamper detectioncircuit 150. This can be, for example, a grounded part of the boardportion 155 of the tamper detection circuit 150, in which case thevoltage C can be zero. The holder nodes 215 can alternately be connectedto a separate power supply, or connected directly to ground, in whichcase the voltage C can again be zero. The holder nodes 215 are optionaland are configured to be electrically connected to conductive boardconnector holders 255 as illustrated in FIG. 2B. The holder nodes 215can be omitted if housing connector holders 430 are used instead, asillustrated in FIG. 4E, or if non-conductive board connector holders 255are used. If the holder nodes 215 are part of the board portion 155 ofthe tamper detection circuit 150, then removal of a board connectorholders 255 would further be detectable at the monitor nodes 530 of theboard portion 155 of the tamper detection circuit 150.

The conductive node set 205A of FIG. 2A also includes a guard ring 220.One or both guard ring sections 220 can be connected to parts of theboard portion 155 of the tamper detection circuit 150. The guard ring ofFIG. 2A includes two guard ring sections 220, namely a first guard ringsection 220A configured to conduct the first voltage A and a secondguard ring section 220B configured to conduct the second voltage B. Theguard ring sections of FIG. 2A are positioned so that the first guardring section 220A partially encircles the second connection node 210B,while the second guard ring section 220B partially encircles the firstconnection node 210A. In this way, each guard ring section 220 carriesthe opposite voltage as the connection node 210 that it partiallyencircles, meaning that a connection between the two would cause a shortdetectable at the monitor nodes 530 of the board portion 155 of thetamper detection circuit 150. Such a short could be caused, for example,by a malicious party flooding the board conductive node set 205A withconductive ink.

In an alternate embodiment, the one or both guard ring sections 220 canconduct a fourth voltage D, and can be connected to a separate powersupply, or connected directly to ground, in which case the voltage D canbe zero. In another alternate embodiment, the guard ring can be wholerather than divided into sections.

The circuit board 100 of FIG. 2A can include other components notpictured in FIG. 2A, such as components for reading, storing, ortransmitting sensitive information as previously described in relationto FIG. 1A, or additional components of the board portion of the tamperdetection circuit 150 such as the components illustrated in FIG. 5A, 5B,or 6.

FIG. 2B illustrates a top-down view of a circuit board with four boardconductive node sets, each attached to a board connector holder forholding a connector piece, with a close-up view of one board conductivenode set and its attached board connector holder.

The circuit board 100 of FIG. 2B is the same circuit board 100 as theone illustrated in FIG. 2A, with the addition of four board connectorholders 255. In particular, a first board connector holder 255A isillustrated over the first board conductive node set 255A, a secondboard connector holder 255B is illustrated over the second boardconductive node set 255B, a third board connector holder 255C isillustrated over the third board conductive node set 255C, and a fourthboard connector holder 255D is illustrated over the fourth boardconductive node set 255D.

A second connector piece 160B is illustrated as held by the second boardconnector holder 255B, a third connector piece 160C is illustrated asheld by the third board connector holder 255C, and a fourth connectorpiece 160D is illustrated as being placed into the fourth boardconnector holder 255D. While the first board connector holder 255A isillustrated as empty, with no corresponding first connector piece 160A,it should be understood that the first board connector holder 255A isalso configured to hold a connector piece 160.

The closeup of the board conductive node set 250A of FIG. 2B is similarto the closeup of the board conductive node set 250A of FIG. 2A with theaddition of the conductive board connector holder 255A. As discussed inrelation to the closeup of FIG. 2A, the board connector holder 255A iselectrically connected to the holder nodes 215, and therefore the boardconnector holder 255A itself conducts the voltage C.

Because the holder nodes 215 can be connected to the board portion 155of the tamper detection circuit 150, the monitor nodes 530 of the boardportion 155 of the tamper detection circuit 150 can detect disruption ofthe tamper detection circuit 150 from removal of the board connectorholder 255. Furthermore, any damage to a board connector holder 255,such as damage from a malicious party drilling through a side of thesecurity housing and through the board connector holder 255, can eithersever the current running through the board connector holder 255 or cancause a short by connecting the board connector holder 255 to anotherelement, such as the connector piece 160 enclosed within the boardconnector holder 255. Accordingly, use of the board connector holder 255provides additional security.

The board connector holder 255 can be made of a metal or anotherconductive material, such as a carbon-based conductor. In addition toallowing the board connector holder 255 to conduct, the hardness of thematerial allows the board connector holder 255 to be thinner than aplastic connector holder, such as the housing connector holder 430 ofFIG. 4E. The hardness of the material also allows the board connectorholder 255 to be constructed to include sidewalls that are perpendicularto the non-conductive board 200, while a plastic connector holder suchas the housing connector holder 430 of FIG. 4E would typically need amore sloped angle. Thus, use of board connector holders 255 allows theentire system—the circuit board 100 enclosed by the security housing—tobe smaller in addition to being more secure, as compared to a systemthat uses housing connector holders 430 as in FIG. 4E.

Furthermore, use of board connector holders 255 can also makemanufacturing easier than use of housing connector holders 430 asdiscussed further in relation to FIG. 4E.

In an alternate embodiment (not pictured), the board connector holder255 can be non-conductive, and the holder nodes 215 can be missing fromthe board conductive node sets 205.

FIG. 3A illustrates a perspective view of a “wire” style connectorpiece.

The majority of the “wire” style 330 connector piece 160 of FIG. 3A iscomprised of an insulating material 305 that can be an elastomer, suchas rubber. The “wire” style 330 connector piece 160 of FIG. 3A includestwo conductive wires 310. Each of these two conductive wires of the“wire” style 330 connector piece 160 is configured to connect, via oneside of the “wire” style 330 connector piece 160, to the one of the twoboard connection nodes 210 of a board conductive node set 205. Each ofthese two conductive wires of the “wire” style 330 connector piece 160is configured to connect, via the other side of the “wire” style 330connector piece 160, to a housing connection node at the end of a tampertrace 420. Exemplary housing connection nodes 535 are illustrated inFIGS. 4C and 4D, for example, numbered 460, 465, 470, 475, 480, 485,490, and 495.

The “wire” style 330 connector piece 160 can cause problems, however. Ifone of the conductive “wires” 310 is too short, or has a break in themiddle, or is dirty, or includes some other manufacturing defect, aresulting faulty connection can be interpreted as a tamper attempt bythe tamper detection circuit 150, which can disable the circuit board100. Similarly, if the “wire” style 330 connector piece 160 isinadvertently moved sideways (i.e., perpendicular to the length of theconductive wires 310), or is manufactured with one or both conductivewires 310 too far to one side, the conductive wires 310 can have afaulty connection that can be interpreted as a tamper attempt by thetamper detection circuit 150, which can disable the circuit board 100.

FIG. 3B illustrates a perspective view of an uncovered “zebra” styleconnector piece.

The uncovered “zebra” style 335 connector piece 160 includes alternatingplanar conductive and non-conductive layers, allowing each connectorpiece 160 to conduct multiple different signals of different voltageswithout shorting out. Multiple conductive layers can conduct eachsignal, increasing connection reliability and assembly tolerance.

The uncovered “zebra” style 335 connector piece 160, however, should notbe used with a conductive holder, such as the board connector holder 255of FIG. 2B, as an undesired connection can form between the connectorpiece 160 and the conductive holder. Such an undesired connection canalter the voltages measured at the measurement nodes of the boardportion 155 of the tampering circuit 150 and can be interpreted as atampering attempt.

FIG. 3C illustrates a perspective view of a covered “zebra” styleconnector piece.

The covered “zebra” style 340 connector piece 160, like the uncovered“zebra” style 335 connector piece 160, includes alternating planarconductive and non-conductive layers, allowing each connector piece 160to conduct multiple different signals of different voltages withoutshorting out.

The covered “zebra” style 340 connector piece 160 also includes aninsulative side covering 320. This allows the covered “zebra” style 340connector piece 160 to be held in place by a conductive holder, such asthe board connector holder 255 of FIG. 2B, without forming a connectionbetween the connector piece 160 and the board connector holder 255.Thus, if a covered “zebra” style 340 connector piece 160 is used, and avoltage change indicative of a connection between the connector piece160 and the board connector holder 255 is detected, it is reasonable toassume that a malicious party has damaged the insulative side covering320, for example by drilling into the security housing from the side, orthat a malicious party has connected the connector piece 160 and theboard connector holder 255 via a metal drill bit, a flood of conductiveink, or another type of tampering attempt.

FIG. 4A illustrates an exterior surface of a top housing. The tophousing 105 of FIG. 4A has a different shape than the top housing 105illustrated in FIG. 1A. The top housing 105 of FIG. 4A also includes theantenna 140 along its exterior surface 145. The antenna 140 can be anytype of antenna 140 discussed with respect to FIG. 1A.

While the housing of FIGS. 4A, 4B, 4C, 4D, and 4E are labeled as a tophousing 105, it should be understood that a bottom housing 110 or sidehousing 115 can be similarly structured.

FIG. 4B illustrates an interior surface of the top housing with noconductive portions shown.

The interior surface 405 of the top housing 105 of FIG. 4B includesconnection areas 415. Endpoints of the tamper traces 420, also referredto as housing connection nodes, are positioned along the connectionareas 415.

The connection areas 415 can optionally be raised relative to the restof the interior surface 405 so that the connection areas 415 are closerto the circuit board 100 than the rest of the interior surface 405 ofthe top housing 105.

The interior surface 405 of the top housing 105 of FIG. 4B includestamper zone recesses 410, illustrated again with tamper traces 420 inFIGS. 4D and 8. The tamper zone recesses 410 are recesses in thenon-conductive portion of the top housing. Tamper traces 420 runningalong the interior surface 405 dip into the tamper zone recesses 410.While the remainder of the interior surface 405 is coated with aninsulative coating 715, the tamper zone recesses 410 are not, exposingthe tamper traces 420. This allows voltage to be measured at differentpoints along the tamper traces 420 via a multimeter or other type ofvoltage probe, allowing a “post-mortem” to be performed on atampered-with system to identify a localized “tamper zone” in which thefailure/tampering occurred, thereby identifying or helping to identifyhow the system was tampered with. The multimeter or voltage probe may bepart of the circuit board 100, or directed by the circuit board, or maybe separate from the system. In some cases, a voltage probe may bepermanently coupled to each of the tamper zone recesses 410 foradditional real-time monitoring of the tamper detection circuit 150 bythe circuit board 100, for example by the board portion 155 of thetamper detection circuit 150.

FIG. 4C illustrates the interior surface of the top housing with anexemplary arrangement of tamper traces of varying voltages.

Some of the tamper traces 420 of FIG. 4C are illustrated using solidlines, while others are illustrated using dashed lines. These areillustrated differently to illustrate different voltages that the tampertraces 420 are configured to convey.

The tamper traces 420 of FIG. 4C run through the tamper zone recesses410 identified in FIG. 4B. The endpoints of the tamper traces 420, alsoreferred to as housing connection nodes, are positioned along theconnection areas 415 identified in FIG. 4B. The housing connection nodesare identified numerically in FIG. 4C, specifically numbered 460, 465,470, 475, 480, 485, 490, and 495.

In particular, one tamper trace 420 of FIG. 4C runs from housingconnection node 460 to housing connection node 475. Another tamper trace420 runs from housing connection node 465 to housing connection node470. Another tamper trace 420 runs from housing connection node 480 tohousing connection node 495. The last tamper trace 420 of FIG. 4C runsfrom housing connection node 485 to housing connection node 490.

The tamper traces 420 of FIG. 4C are laid out to cover the entirety ofthe interior surface 405 of the housing 105, including the sidewallsurfaces and the connection areas 415. The tamper traces 420 of FIG. 4Care laid out so that tamper traces 420 of different voltages runparallel to each other, so that a malicious party's metal drill bitboring through the housing 105 shorts out the tamper detection circuit150 by connecting tamper traces 420 of differing voltages.

In one embodiment, the tamper traces 420 can be arranged to serve notonly as part of the housing portion of the tamper detection circuit 150,but also simultaneously as an antenna 140 as described in relation toFIG. 1A or FIG. 4A. Such an antenna 140 can be any type of antenna 140discussed with respect to FIG. 1A.

FIG. 4D illustrates the interior surface of the top housing with aschematic diagram of tamper traces of varying voltages the arrangementof FIG. 4C.

The simplified arrangement of tamper traces 420 of FIG. 4D includes thesame layout of tamper trace 420 endpoints as FIG. 4C. That is, a firsttamper trace 420 of FIG. 4D runs from housing connection node 460 tohousing connection node 475. Another tamper trace 420 runs from housingconnection node 465 to housing connection node 470. Another tamper trace420 runs from housing connection node 480 to housing connection node495. The last tamper trace 420 of FIG. 4D runs from housing connectionnode 485 to housing connection node 490.

FIG. 4E illustrates the interior surface of the top housing with noconductive portions shown and with housing connector holders. Thehousing of FIG. 4E is illustrated without any of its conductive tampertraces 420 for visual clarity.

As discussed in relation to FIG. 2B, a system (i.e., a circuit board 100and enclosed by a security housing) using board connector holders 255can be built to be smaller and more secure than a system using housingconnector holders 430 as in FIG. 4E.

Furthermore, use of board connector holders 255 can also makemanufacturing easier than use of housing connector holders 430 as inFIG. 4E. Housing connector holders 430 typically need plastic sidewalls435, which, to be secure, should also include tamper traces 420. Theneed to add tamper traces 420 to the plastic sidewalls 435 can furtherincrease how large they need to be, further increasing the size of thesystem as a whole. This, in addition to the added size and complexangles needed to produce the housing connector holders 430 addsadditional complexity to the manufacturing of such a housing. Forexample, if the housing 105 is manufactured using LDS, multiple lasersessions could be required to cover the larger size and/or to cover thecomplex angles of the interior surface 405 if housing connector holders430 are used. Etching/printing the tamper traces 420 using multiple LDSlaser sessions increases the risk of a manufacturing defect; forexample, a slight movement of the housing and/or laser between lasersessions could cause a misalignment along a tamper trace 420,potentially causing a break or a weak connection point along the tampertrace.

On the other hand, use of board connector holders 255 as in FIG. 2B isadvantageous as it allows the housing 105 to be smaller and lesscomplex, allowing the interior surface 405 of the housing 105 to bemanufactured with fewer LDS laser sessions, or even a single LDS lasersession. This, in turn, also decreases the risk of manufacturing defectssuch as misalignments along tamper traces 420.

FIG. 5A is a circuit diagram illustrating a discrete comparison tampercircuit. A legend 510 is included in FIG. 5A to interpret the circuitdiagram.

The discrete comparison tamper circuit 505 is one layout of a competetamper detection circuit 150. The discrete comparison tamper circuit 505is powered by a power supply 515, which can optionally operate at 2.2volts. The discrete comparison tamper circuit 505 includes four legsconnected in parallel. Each leg includes a discrete resistor 525connected in series with a tamper trace 420 acting as a resistor 520,with a monitor node 530 connected in series between the discreteresistor 525 and the tamper trace 420 520. The discrete resistors 525can, for example, be 220 kiloohm (kΩ) resistors. The discrete comparisontamper circuit 505 of FIG. 5A also illustrates the positions of thehousing connection nodes 535 within the circuit, including housingconnection nodes 460, 465, 470, 475, 480, 485, 490, and 495.

The discrete comparison tamper circuit 505 includes four monitor nodes530—one corresponding to each tamper trace 420. The monitor nodes 530are monitored relative to ground.

The discrete comparison tamper circuit 505 can identify disconnectionsalong tamper traces 420 by checking voltages at the monitor nodes 530.However, the discrete comparison tamper circuit 505 does not have a wayto detect short circuits, and therefore is vulnerable to maliciousparties short-circuiting portions of the discrete comparison tampercircuit 505.

Furthermore, the discrete comparison tamper circuit 505 can have issuesin certain environmental conditions. For example, in high heat or highhumidity, a parasitic resistance 590 can develop between different legsof the discrete comparison tamper circuit 505. Two exemplary parasiticresistances 590 are illustrated in FIG. 5A. A parasitic resistance 590develops between points on parallel legs that are not directlyconnected. The parasitic resistance 590 modifies the voltage monitoredat the monitor nodes 530, producing a “false positive” indication oftampering when no tampering has occurred, potentially disabling thecircuit board 100 as a result.

FIG. 5B is a circuit diagram illustrating a wheatstone bridge tampercircuit.

The wheatstone bridge tamper circuit 555 of FIG. 5B is also powered by apower supply 515, which again can optionally provide current at 2.2volts. The wheatstone bridge tamper circuit 555 provides includes twolegs connected in parallel, the legs including two tamper traces 420behaving as resistors 520 in series with a monitor node 530 in betweenthe tamper traces 420 of each leg. A differential voltage between bothof the monitor nodes 530 is then tracked.

The wheatstone bridge tamper circuit 555 is able to detect shortcircuits along the wheatstone bridge tamper circuit 555, unlike thediscrete comparison tamper circuit 505. The wheatstone bridge tampercircuit 555 is also resistant to the environmental effects that thediscrete comparison tamper circuit 505 is subject to. Any parasiticresistances develop symmetrically and thus do not effect thedifferential voltage measured between the monitor nodes 530.

FIG. 6 is a flow diagram illustrating additional components of a tampercircuit.

The flow diagram of FIG. 6 identifies circuit components of the tamperdetection circuit 150, as well as an optional order in which thesecircuit components are applied. The tamper detection circuit 150receives the analog output 610 of the monitor nodes 530 as its input.These are passed through a gain block 620 to amplify the signals. Theseare passed through an absolute value component 630 to make voltagevalues positive.

The resulting voltage values are passed to a comparator 640, whichresults in tamper detection 650 based on the results of the comparisonperformed by the comparator 640. The comparator 640 in a discretecomparison circuit 505, compares the voltages at the monitor nodes 530to ground nodes. The comparator 640 in a wheatstone bridge tampercircuit 555, compares the voltages at the monitor nodes 530 to eachother.

While the flow diagram of FIG. 6 provided and described above can show aparticular order of operations performed by certain embodiments of theinvention, it should be understood that such order is exemplary.Alternative embodiments can perform the operations in a different order,combine certain operations, overlap certain operations, or somecombination thereof.

FIG. 7A is an exploded side view of a circuit board with board connectorholders connecting to a top housing via connector pieces.

The exploded side view of FIG. 7A illustrates two tamper traces 420 andthe direction in which current is flowing through them. The circuitboard 100 of FIG. 7A includes board connector holders 255 keeping theconnector pieces 160 in place between the circuit board 100 and thehousing 105.

FIG. 7B is an exploded side view of a circuit board connecting to a tophousing with housing connector holders via connector pieces.

The exploded side view of FIG. 7B likewise illustrates two tamper traces420 and the direction in which current is flowing through them. Thecircuit board 100 of FIG. 7A includes housing connector holders 430keeping the connector pieces 160 in place between the circuit board 100and the housing 105.

FIG. 8 is an exploded side view of an exemplary tamper zone recess.

The security housing includes a non-conductive housing portion 705. Thenon-conductive housing portion 705 itself includes a recess at thetamper zone recess 410 position. Each tamper trace 420, whenlaser-etched or otherwise laid along the non-conductive housing portion705, is laid along the tamper zone recess 410 of the non-conductivehousing portion 705. An insulative coating 715 is then laid over thetamper traces 420 other than over the tamper zone recess 410.

The tamper traces 420 are thus accessible to a multimeter or voltageprobe at the tamper zone recess 410 as discussed with regard to FIG. 4B.Because the tamper trace 420 in the tamper zone recess 410 is in arecess, it is further away from the circuit board 100, preventing a thetamper traces 420 from coming into contact with the circuit board 100and causing a short circuit or other unwanted connection. This protectsboth the tamper detection circuit 150 and the circuit board 100 fromelectrical interference.

FIG. 9 illustrates exemplary circuit board components 900 that may beused to implement an embodiment of the present invention. The circuitboard 100 described herein may include any combination of at least asubset of the circuit board components 900. In some embodiments, thecircuit board 100 may actually include multiple circuit boards connectedin a wired or wireless fashion, some of which may be at least partiallyenclosed by the security housing.

The circuit board components 900 of FIG. 9 may include one or moreprocessors, controllers, or microcontrollers 910. These may in somecases aid in tamper detection, such as by performing at least somesubset of the functions identified in FIG. 6. The circuit boardcomponents 900 of FIG. 9 may include one or more memory components 910that may store, at least in part, instructions, executable code, orother data for execution or processing by the processor or controller910. The memory components 910 may include, for example, cache memory,random access memory (RAM), read-only memory (ROM), or some other typeof computer-readable storage medium.

The circuit board components 900 of FIG. 9 may further includes one ormore computer-readable storage medium(s) 930 for storing data, such as ahard drive, magnetic disk drive, optical disk drive, flash memory,magnetic tape based memory, or another form of non-volatile storage.These may, for example, store credit card information, cryptographickeys, or other information, and may in some cases encrypt or decryptsuch information with the aid of the processor or controller 910. Thecomputer-readable storage medium(s) 930 may in some cases store, atleast in part, instructions, executable code, or other data forexecution or processing by the processor or controller 910.

The circuit board components 900 of FIG. 9 may include tamper detectioncircuitry 940, which may include any of the tamper detection circuit 150discussed herein, and may include the board connector piece holder(s)255 and any components discussed in FIG. 6.

The circuit board components 900 of FIG. 9 may include output devicecircuitry 950, which may include, for example, communication circuitryfor outputting data through wired or wireless means, display circuitryfor displaying data via a display screen, audio circuitry for playingaudio via headphones or a speaker, printer circuitry for printing datavia a printer, or some combination thereof. The display screen may be aliquid crystal display (LCD), a plasma display, an organiclight-emitting diode (OLED) display, an electronic ink display, aprojector-based display, a holographic display, or some combinationthereof. The printer may be inkjet, laserjet, thermal, or somecombination thereof. In some cases, the output device circuitry 950 mayallow for transmission of data over an headphone audio jack, amicrophone jack, BLUETOOTH™ wireless signal transfer, radio-frequencyidentification (RFID), near-field communications (NFC), 802.11 Wi-Fi,cellular network data transfer, or some combination thereof. The outputdevice circuitry 950 may also include

The circuit board components 900 of FIG. 9 may include input devicecircuitry 960, which may include, for example, communication circuitryfor outputting data through wired or wireless means, microphonecircuitry for receiving audio data, user interface circuitry forreceiving user interface inputs, or some combination thereof, and mayinclude variable pressure detection. Touchscreens may be capacitive,resistive, acoustic, or some combination thereof. In some cases, theinput device circuitry 960 may allow receipt of data over an headphoneaudio jack, a microphone jack, BLUETOOTH™ wireless signal transfer,radio-frequency identification (RFID), near-field communications (NFC),802.11 Wi-Fi, cellular network data transfer, or some combinationthereof. Input device circuitry 960 may receive data from analpha-numeric keypad or keyboard, a pointing device, a mouse, atrackball, a trackpad, a touchscreen, a stylus, cursor direction keys,or some combination thereof. The input device circuitry 960 may alsoreceive data from the card reader circuitry 970.

The circuit board components 900 of FIG. 9 may include card readercircuitry 970, which may include components capable of readinginformation from a transaction card, or may include circuitry supportingcomponents capable of reading information from a transaction card, withthe actual card reader components located off of the circuit board 100.Card reader circuitry 970 may include, for example, a magnetic read heador other type of magnetic stripe reader that is capable of readinginformation from a magnetic stripe of a transaction card. Card readercircuitry 970 can also include an integrated circuit (IC) chip readerfor reading an IC chip embedded in a transaction card. Such an IC chipcan follow the Europay-Mastercard-Visa (EMV) payment IC chip standard.The IC chip reader can be contact-based, in that it can include one ormore conductive prongs that contact a conductive metal contact pad ofthe IC chip. The IC chip can instead be contactless and use acontactless antenna. The contactless antenna can also double as areceiver for near-field-communication (NFC) signals, radio-frequencyidentification (RFID) signals, BLUETOOTH™ wireless signals, or somecombination thereof, which can be sent from a transaction card or from aportable computing device.

Peripheral circuitry 980 may include any type circuitry permittingconnection and use of computer support devices to add additionalfunctionality to the circuit board 100. For example, peripheralcircuitry 980 may support connection of a modem or a router. Thecomponents shown in FIG. 9 are depicted as being connected via a singlebus 990. However, the components may be connected through one or moredata transport means. For example, processor unit 910 and main memory910 may be connected via a local microprocessor bus, and the storagemedium 930, tamper detection circuitry 940, output device circuitry 950,input device circuitry 960, card reader circuitry 970, and peripheralcircuitry 980 may be connected via one or more input/output (I/O) buses.

The foregoing detailed description of the technology has been presentedfor purposes of illustration and description. It is not intended to beexhaustive or to limit the technology to the precise form disclosed.Many modifications and variations are possible in light of the aboveteaching. The described embodiments were chosen in order to best explainthe principles of the technology, its practical application, and toenable others skilled in the art to utilize the technology in variousembodiments and with various modifications as are suited to theparticular use contemplated. It is intended that the scope of thetechnology be defined by the claim.

The invention claimed is:
 1. A secure electronic system comprising: asecurity housing comprising: a non-conductive housing, and a housingportion of a tamper detection circuit; a plurality of connector piecesconnecting the housing portion of the tamper detection circuit to aboard portion of the tamper detection circuit, thereby completing thetamper detection circuit; and a circuit board, wherein at least aportion of the circuit board is covered by the security housing, thecircuit board comprising: a board, the board portion of the tamperdetection circuit including a voltage monitor node, wherein the boardportion of the tamper detection circuit detects tampering with thetamper detection circuit by detecting a voltage change along the tamperdetection circuit using the voltage monitor node, and a plurality ofboard connector piece holders, wherein each board connector piece holderof the plurality of board connector piece holders includes conductivematerial and holds a connector piece of the plurality of connectorpieces without forming an electrical connection between the conductivematerial and the connector piece unless tampered with, whereinelectrical contact between the conductive material of at least one ofthe plurality of board connector piece holders and the tamper detectioncircuit indicates tampering and causes the voltage change along thetamper detection circuit that is detected using the voltage monitornode.
 2. The secure electronic system of claim 1, wherein the board hasconductive circuitry thereon, and wherein each of the plurality of boardconnector piece holders are electrically connected to different pointsalong the conductive circuitry.
 3. The secure electronic system of claim1, wherein the security housing includes at least two clip pocketsconfigured to receive compression clips, the compression clips tocompress at least a portion of the circuit board and thereby preventbowing of the circuit board.
 4. The secure electronic system of claim 1,wherein the housing portion of the tamper detection circuit includes aplurality of conductive tamper traces, wherein a first conductive tampertrace of the plurality of conductive tamper traces conveys a differentvoltage than a second conductive tamper trace of the plurality ofconductive tamper traces.
 5. The secure electronic system of claim 1,wherein each board connector piece holder of the plurality of boardconnector piece holders includes a sidewall section that extends fromand is oriented perpendicular to a planar surface of the board.
 6. Asystem for improved security for electronics, the system comprising: acircuit board comprising: a board portion of a tamper detection circuitthat conveys one or more tamper detection circuit voltages and thatdetects an attempt to tamper with the tamper detection circuit bydetecting a voltage change along the tamper detection circuit, and aplurality of board connector piece holders, wherein each board connectorpiece holder of the plurality of board connector piece holders includesconductive material and holds a connector piece of a plurality ofconnector pieces without forming an electrical connection between theconductive material and the connector piece unless tampered with,wherein electrical contact between the conductive material of at leastone of the plurality of board connector piece holders and the tamperdetection circuit is indicative of the attempt to tamper and causes thevoltage change that is detected using the tamper detection circuit; anda security housing comprising: a non-conductive housing with an exteriorsurface and an interior surface, a housing portion of the tamperdetection circuit running along the interior surface of thenon-conductive housing, wherein the housing portion of the tamperdetection circuit conveys the one or more tamper detection circuitvoltages and electrically connects to the board portion of the tamperdetection circuit via the plurality of connector pieces.
 7. The systemof claim 6, wherein the security housing further comprises: a testingrecess in the interior surface of the non-conductive housing, wherein atleast a subset of the housing portion of the tamper detection circuit ispositioned along the testing recess, and an insulative coating coveringthe housing portion of the tamper detection circuit other than over thetesting recess.
 8. The system of claim 6, wherein the housing portion ofthe tamper detection circuit includes a plurality of conductive tampertraces running along the interior surface of the non-conductive housing,wherein a first conductive tamper trace of the plurality of conductivetamper traces conveys a different voltage than a second conductivetamper trace of the plurality of conductive tamper traces.
 9. The systemof claim 8, wherein at least one of the plurality of conductive tampertraces is also an antenna of a wireless signal transceiver.
 10. Thesystem of claim 6, wherein the circuit board has conductive circuitrythereon, and wherein each of the plurality of board connector pieceholders are electrically connected to different points along theconductive circuitry.
 11. The system of claim 6, the circuit boardfurther comprising one or more voltage monitor nodes, wherein the boardportion of the tamper detection circuit is configured to detect theattempt to tamper with the tamper detection circuit by detecting thevoltage change along the tamper detection circuit using the one or morevoltage monitor nodes.
 12. The system of claim 6, wherein the the changein voltage along the tamper detection circuit is caused by electricalcontact between the conductive material of at least one of the pluralityof board connector piece holders and at least one connector piece of thetamper detection circuit.
 13. The system of claim 6, wherein each boardconnector piece holder of the plurality of board connector piece holdersincludes a sidewall section that extends from and is orientedperpendicular to a planar surface of the circuit board.
 14. The systemof claim 6, wherein a voltage of at least one of the plurality of boardconnector piece holders is at ground.
 15. The system of claim 6, whereinthe plurality of board connector piece holders are each distinctcomponents.
 16. The system of claim 6, wherein at least one of theplurality of board connector piece holders is electrically coupled to aseparate voltage source distinct from the tamper detection circuit. 17.The system of claim 6, wherein the conductive material of each boardconnector piece holder is configured to convey a board connector pieceholder voltage other than the one or more tamper detection circuitvoltages.
 18. A system for tamper-proofing electronics, the systemcomprising: a housing portion of a tamper detection circuit disposedalong a security housing; a circuit board comprising a plurality ofconnector piece holders, wherein each of the plurality of connectorpiece holders includes conductive material; and a board portion of thetamper detection circuit that is disposed along the circuit board andthat includes a voltage monitor node, wherein the board portion of thetamper detection circuit detects an attempt to tamper with the tamperdetection circuit by detecting a voltage change along the tamperdetection circuit using the voltage monitor node, wherein the boardportion of the tamper detection circuit is connected to the housingportion of the tamper detection circuit via a plurality of connectorpieces, wherein each connector piece of the plurality of connectorpieces is held by one of the plurality of connector piece holderswithout forming an electrical connection between the conductive materialand the connector piece unless tampered with, and wherein electricalcontact between the tamper detection circuit and the conductive materialof at least one of the plurality of board connector piece holdersindicates tampering and causes the voltage change along the tamperdetection circuit that is detected using the voltage monitor node. 19.The system of claim 18, the tamper detection circuit further comprisinga second voltage monitor node, wherein the tamper detection circuit isconfigured to detect the attempt to tamper using the voltage monitornode and the second voltage monitor node.
 20. The system of claim 19,wherein the tamper detection circuit includes a wheatstone bridgecircuit that comprises at least the voltage monitor node and the secondvoltage monitor node.
 21. The system of claim 18, wherein the pluralityof board connector piece holders are distinct from each other.
 22. Thesystem of claim 18, wherein the housing portion of the tamper detectioncircuit includes a plurality of conductive tamper traces running alongat least one surface of the security housing, wherein a first conductivetamper trace of the plurality of conductive tamper traces conveys adifferent voltage than a second conductive tamper trace of the pluralityof conductive tamper traces.